[BACK]Return to history.html CVS log [TXT][DIR] Up to [local] / www / openssh
File: [local] / www / openssh / history.html (download) (as text)

Revision 1.55, Thu Apr 16 01:21:50 2020 UTC (4 years, 1 month ago) by dtucker
Branch: MAIN
CVS Tags: HEAD
Changes since 1.54: +2 -1 lines 

Restore OSSH link pointing to current location.  ok tj@

<!doctype html>
<html lang=en>
<meta charset=utf-8>

<title>OpenSSH: Project History</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="canonical" href="https://www.openssh.com/history.html">
<link rel="stylesheet" type="text/css" href="openbsd.css">

<h2 id=OpenBSD>
<a href="/">
<i>Open</i><b>SSH</b></a>
Project History
</h2>
<hr>

<p>
In 1999, some OpenBSD developers set to the task of freeing SSH, cleaning
up the license mess, and maintaining the codebase towards the future.

<p>
OpenSSH is a derivative of the original free ssh 1.2.12 release
from Tatu Yl&ouml;nen. That version was the last one free enough
for reuse. Parts of OpenSSH still bear Tatu's license, which was contained
in that release. That version, and earlier ones, used mathematical functions
from the libgmp library, which was directly included at the time. It is now
made available under the Lesser GNU Public License, but versions of that era
were under the regular GNU Public License.

<p>
A combined license for all the pieces is available at
<a href="https://cvsweb.openbsd.org/src/usr.bin/ssh/LICENCE?rev=HEAD">
https://cvsweb.openbsd.org/src/usr.bin/ssh/LICENCE</a>.

<p>
Rapidly after Tatu's 1.2.12 release, newer versions bore successively more
restrictive licenses, even though libgmp was still included and necessary
for using the software.  That effectively made SSH a GPL violation.  The
first of the restrictive licenses forbade people from making a Windows or
DOS version.  Later licenses restricted the use of ssh in a commercial
environment, instead requiring companies to buy an expensive version from
a company called Datafellows.

<p>
Early in 1999, Bj&ouml;rn Gr&ouml;nvall re-discovered the old free release
and started fixing bugs. His version of ssh was called
<a href="https://pkgserver.pdc.kth.se/pub/krypto/ossh/">OSSH</a>
and had only support for the SSH 1.3 protocol. Word of mouth has it that OSSH
was integrated at the time into some commercial products in Sweden. OSSH
never graduated to SSH 2 protocol support. Bj&ouml;rn probably ceased
development as OpenSSH became mature.

<p>
OpenBSD project members became aware of Bj&ouml;rn's work less than two months
before the
<a href="https://www.openbsd.org/26.html">OpenBSD 2.6 release</a>. We wanted to
include support for the ssh protocol in the 2.6 release, but we had to make
sure that it was perfect. Therefore, we decided to immediately fork from the
OSSH release, and pursue rapid development using the same process as the
original OpenBSD security auditing process. The initial import was done on
Sep 26, 1999, and, at the time of release two months later, many of the source
code files were already at RCS revision 1.34... some as high as 1.66.
Development went very fast indeed, since we had a deadline to meet.

<p>
The following team members participated:

<ul>
<li>Theo de Raadt (CANADA) started by removing non-portabilities which made
the code harder to read &mdash; the goal being simpler source code, so that
security holes and other issues could be spotted easier.
<li>Niels Provos (GERMANY but living in USA) quickly removed the remaining
cryptographic and GPL'd components by doing road trips to Canada, so that
we could end up with a completely freely reusable source code base.
<li>Markus Friedl (GERMANY) jumped in and very quickly managed to replace
the SSH 1.3 protocol code from the 1.2.12 release, with a SSH 1.5 protocol
implementation compatible with the modern "ssh 1.2.27" series (this change
was needed to operate with a lot of SSH-compatible Windows clients which
lack support for SSH 1.3 protocol).
He added SSH 1.5 protocol support in such a way that SSH 1.3 protocol support
remained operational.  Later, he also added support for SSH 2 protocol and SFTP.
<li>Bob Beck (CANADA) helped with Makefile magic to ensure that we could
compile OpenSSL without patented algorithms. Because OpenBSD 2.6 was shipping
before the RSA patent expiration date, we needed to ship our CD with libssl
and libcrypto shared libraries which lacked RSA.  At install time, the user
was able to replace these libraries via FTP/HTTP over the Internet.  Luckily
this kind of hackery is no longer needed.
<li>Aaron Campbell (CANADA) improved numerous documentation flaws and a
few other code problems.  It is mostly due to him that the manual pages are
so complete.
<li>Dug Song (USA) helped with some authentication issues in the KerberosIV
case (his changes were carefully checked to ensure they stayed away from
any cryptography, and only touched on authentication issues).
</ul>

<p>
Therefore, the version of OpenSSH was based on these older versions of
ssh 1.2.12, but with many bugs removed and newer features re-added:

<ul>

<li>has all components of a restrictive nature (i.e. patents,
see <a href="https://man.openbsd.org/ssl.8">ssl</a>)
directly removed from the source code; any licensed or patented components
are chosen from external libraries.

<li>supports one-time password authentication with
<a href="https://man.openbsd.org/skey.1">skey</a>.

<li>hundreds of other changes that people can spot in the new man pages, and
in the source code changes.

</ul>

<p>
That marked the OpenSSH 1.2.2 release, which was shipped with OpenBSD 2.6 in
December 1, 1999.  As of that time, most OpenSSH development had been done
by Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo de Raadt,
and Dug Song.  We thank the many people who have found bugs and reported them.

<h3 id=portable>Porting OpenSSH</h3>
<p>
Almost immediately after we shipped our protocol 1 implementation,
various non-OpenBSD groups got very, very interested.  Damien Miller,
Philip Hands, and handful of others started porting OpenSSH to Linux
and various other Unix operating systems.  From the start of our own
efforts, we have felt that even the original ssh code was too
complicated, it simply had too many operating system dependencies to
deal with.  Our approach to writing completely secure and rock solid
code avoids dealing with excessive differences like that.  Thus, to
make the entire development process easier on us all, we decided to
split our core development efforts from portability developments.
This has worked out very well for us.  (As a case in point, compare the
number of lines of code between the baseline and portable versions).

<h3>SSH 2 Protocol Support</h3>
<p>
With the OpenBSD 2.6 release out of the way, Markus Friedl decided to
pursue <a href="goals.html">SSH 2 protocol</a> support.  Slaving away for
months, he managed to keep OpenSSH slim and lean, while at the same
time managing to turn it into a single piece of software that could do
both the SSH 1 and SSH 2 protocols.  This version, called OpenSSH 2.0,
shipped with OpenBSD 2.7 on June 15, 2000.  Most of the checking of Markus'
changes were done by Niels Provos and Theo de Raadt.  Bob Beck is to be
thanked for updating the external SSL library to a newer version.

<h3>SFTP Support</h3>
<p>
Support for the server side of the SFTP sub-protocol was written by Markus
Friedl and released in the 2.3.0 release, in November 2000.  Soon after,
Damien Miller started work on an sftp client, which first shipped in 2.5.0.

<h3>Scanning SSH Server Versions</h3>
<p>
To facilitate the monitoring of deployed SSH servers, e.g. for a
company network, Niels Provos wrote the
<a href="https://www.monkey.org/~provos/scanssh/">scanssh</a>
tool.  scanssh scans a list of addresses and networks for running SSH
servers and their version numbers.  It supports random selection of IP
addresses from large network ranges and is useful for gathering
statistics on the use of SSH servers in a company or the Internet as
whole.  The statistics include the SSH protocol supported, and the software
versions that are being used.